What this site does with your data.
Written from the code that runs on this site, not from a template. Analytics stay switched off until you accept them, and you can change that choice at any time. What the servers record to keep the site up, and what happens to an enquiry once you send one, do not depend on that choice — both are set out below.
Last updated 28 October 2026
Scope
This notice covers the public website at meramia.com. It does not cover client engagements — those are governed by the contract signed for the engagement — and it does not cover any third-party site you reach from a link here.
Before you choose, nothing non-essential runs
Analytics are switched off by default. Google consent signals are set to denied before any Google script is allowed to load, so on a first visit no analytics cookie is written and no analytics request is made. Nothing is kept in your browser before you decide except the decision itself, once you make it. The server-side access logs described further down are a separate matter: they are written for every request to any page, as they are on any site, and your consent choice neither switches them on nor switches them off.
If you accept analytics
Two things start, and only these two:
- Google Analytics 4, with IP anonymisation on. Only the analytics consent signal is granted. The advertising signals stay denied, because this site runs no advertising and does not build advertising audiences.
- A first-party record of how you found us, kept in this browser and in a first-party cookie. It holds: a random visitor identifier; the page you first arrived on and the page you most recently arrived on, each with a timestamp; the external site you came from, if any; campaign parameters in the link you followed (the standard utm parameters, plus Google and Meta click identifiers); a count of visits; and the Google Analytics client identifier, so an enquiry can be connected to the visit it came from.
The visitor identifier is a random value. It is not derived from your name, your address, or anything you typed, and it is not shared with anyone.
If you decline
No analytics script loads and no visitor record is created. Only your choice is remembered, so you are not asked on every page.
If you accepted earlier and then decline, the withdrawal is real rather than cosmetic: Google Analytics is told to stop, and the visitor identifier and the visit record are deleted from this browser.
Cookies and browser storage
| Name | Where | Why | Kept for |
|---|---|---|---|
| meramia-consent | Cookie and local storage | Essential — remembers your analytics choice | Two years |
| meramia_vid | Cookie | Analytics — the random visitor identifier | Two years |
| meramia_visit | Local storage | Analytics — first and most recent visit, campaign parameters, visit count | Until you decline or clear this browser |
| meramia_session | Session storage | Analytics — counts one visit per browser tab | Until the tab closes |
| _ga and _ga_… | Cookie, set by Google | Google Analytics | Set by Google, typically two years |
| meramia_contact_queue | Local storage | Holds an enquiry that could not be delivered, so it can be retried | Up to seven days |
Only the first of these is written regardless of your choice; it exists so the site can honour the choice you made.
The enquiry form
The form asks for your first and last name, your company and your role (both optional), your email address, the service you are interested in, and your message. It does not travel to us as an email. The request is rewritten at our edge onto MXENE, the customer-relationship system Meramia builds and runs, and MXENE writes it to a database in a single transaction, as the records below:
- A lead — your name, your company, your email address, a telephone number if the form carried one, and the source the enquiry is attributed to, taken from the campaign parameters in your link when they are present.
- A note on that lead — the service you chose and your message, written when you gave either, so the enquiry reads on the lead itself.
- The submission — the complete payload the form posted, your role and your message included, stored as it arrived. When you have accepted analytics, the attribution record described above travels inside that payload and is stored with it. It is what connects an enquiry to the visit it came from.
- An audit entry for the capture, which holds its own copy of that submission.
- A lead score, computed at the moment of capture. A first enquiry with nothing else known about it scores zero; the field is written so that it is never empty.
MXENE runs on a server we operate in the Europe (Ireland) region, so your enquiry is processed outside the UAE, and it is read and answered there rather than forwarded to a mailbox. Signing in to the system requires a Meramia account behind our own authentication, and the records are not exposed to anyone else.
The form carries a hidden field that real people never fill in. If it is filled in, the submission is treated as automated and discarded before any of those records is written.
If an enquiry cannot be delivered
When the network or the capture service fails, your enquiry is kept in this browser so it can be retried rather than silently lost. That copy holds what you typed and, if analytics are accepted, the attribution record. It is deleted as soon as the enquiry is delivered, and it expires after seven days.
Expiry is checked the next time you open the site, not on a timer — so if you never return, the copy stays in your browser until you clear it. On a shared or public computer, clearing your browser data is the reliable way to remove it.
How long an enquiry is kept, and how it is erased
The retention period for the lead, its note, the submission and the audit entry is under review. It is not set, and this notice will name it, with the rule that fixes it, once it is. Publishing a plausible-sounding figure in the meantime would turn a guess into a commitment we have not made, which is a worse answer than an open one.
Erasure is available now and is carried out by hand; no automated route exists yet. On request the personal fields in those records are overwritten so that what remains no longer identifies you, rather than the rows being deleted outright — the audit entry is what allows us to show afterwards what was held and what was removed. Ask through the enquiry form and say what you want erased.
What is never sent to analytics
Your name, your email address, your company, your role and your message are never included in any analytics event. Only the service you selected, whether the send was a retry, and how many visits preceded the enquiry are measured. This is enforced automatically: the pre-deploy quality gate fails the build if any of those field names appears in an analytics payload.
Server-side logs
Delivering a page leaves a trace that owes nothing to your consent choice. Amazon CloudFront, the delivery network in front of this site, writes one line for every request it serves: the network address the request came from, the path asked for, the referring page where the browser sends one, the browser's user-agent string, and the status the edge returned. Those lines are written to a private Amazon S3 bucket in the Europe (Ireland) region, where they explain an error after it happens; no copy of them is kept anywhere else. The job-application service writes its own execution log to Amazon CloudWatch in the same region. When you send an enquiry, the MXENE server that receives it writes one line of its own for that request: the time, the path, the status it returned, how long it took and a random request identifier. That line holds no network address, no query string and none of what you typed. MXENE's log store on the same Ireland server keeps it for ninety days, and the server keeps its own copy in one file per day, deleted after ninety days.
None of those stores is reachable from the public internet, none feeds advertising or analytics, and none is passed to anyone beyond the infrastructure providers holding them on our behalf. Every one of these is bounded at ninety days, after which it is removed.
Your choices
- Change your analytics choice at any time with the Manage cookies control in the footer of every page.
- Clear everything by clearing cookies and site data for this site in your browser.
- Your browser's Do Not Track or global privacy controls do not switch analytics on; nothing loads unless you accept.
Job applications
Each open role has a form on its own page. The form asks for your name, a work email, a CV (PDF or DOCX), a GitHub URL, a LinkedIn URL, and an optional note.
- The CV and a JSON record of the fields are written to a private Amazon S3 bucket in the Europe (Ireland) region. The bucket is not the website origin and is not reachable from the public internet.
- A copy of the fields and the S3 object path is emailed to the hiring mailbox, with your address set as the reply address.
- We keep that record for the life of the search and remove it when the search closes, in no case longer than twelve months, with the copies versioned storage keeps behind them removed within a further thirty days.
- The form carries the same hidden field as the enquiry form. If it is filled in, the submission is discarded.
- Analytics events for an application, if any, carry only the role slug — never your name, email, or the file.
Your rights
Under the UAE Personal Data Protection Law you may ask what personal data we hold about you, ask for it to be corrected or deleted, object to or restrict its processing, and withdraw a consent you gave. An enquiry lives as the records described above, the attribution record among them. An application lives as the objects in that private bucket and as the message that announced it. Anything analytics gathered lives in this browser and with Google, under the choice you made, and goes when you withdraw it.
To make a request, use the enquiry form and say what you are asking for; it is the only route in, since this site publishes no mailbox and no phone number. A request sent that way is itself captured as an enquiry, so say in the message that you want the request removed alongside whatever else you are asking about. We reply within one UAE business day.
Changes
This notice changes when the site changes. The date at the top is the version in force; there is no archive of earlier versions.